[HIVE-13532] MapredLocalTask should use the same security settings as remote task

• Type: Bug
• Status: Patch Available
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.1.0
• Fix Version/s: 1.3.0
• Component/s: Security

Environment

HADOOP_PROXY_USER is set.

• Assignee: Changshu Liu
• Reporter: Zhiwen Sun
• Created: 18/Apr/16 03:04
• Updated: 21/Oct/22 07:31

Description

Map join set HADOOP_USER_NAME should be realuser's username.

Current, hive set HADOOP_USER_NAME env for mapjoin local process according:

String endUserName = Utils.getUGI().getShortUserName();

suppose set HADOOP_PROXY_USER=abc in shell.

map join local job will have following env:

HADOOP_USER_NAME=abc
HADOOP_PROXY_NAME=abc

this will cause such exception:

java.io.IOException: org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.authorize.AuthorizationException): User: abc is not allowed to impersonate

I think we should set HADOOP_USER_NAME to realuser:

String endUserName = Utils.getUGI().getRealUser().getShortUserName();